Step 1- Configure WAF

The WAF terminates HTTPS, sends plain HTTP to port 80 on the VM, and messages UMP-365 that the original request is HTTPS.

Why X-Forwarded-Proto matters.

➢

To configure the WAF:

Configure the Application Gateway WAF v2 according to the table below.

Setting Value Why

Frontend listener HTTPS, port 443, host ump.example.com, your public certificate This is where the certificate is stored.

Second listener HTTP, port 80, with a redirect rule to the HTTPS listener Users who type http:// end up on HTTPS

TLS policy A predefined policy with TLS 1.2 as the minimum, for example AppGwSslPolicy20220101 Older TLS versions are a scan finding of their own

Backend pool The private IP address of the UMP VM

Backend settings: protocol and port HTTP, port 80 The SSL offloading itself

Backend settings: override with new host name No UMP builds its sign-in and redirect URLs from the Host header. It must stay ump.example.com

Backend settings: request timeout

120 seconds or more

The default of 20 seconds is too short for bulk uploads and large exports

Forwarded headers

Leave the defaults

Application Gateway adds X-Forwarded-Proto and X-Forwarded-For.

UMP-365 receives plain HTTP from the WAF, where these headers identify that the source packets are HTTPS. If the header is missing:

■ Entra ID sign-in fails, because UMP-365 sends http://ump.example.com/tenantui/signin-aad as the redirect URI and Entra ID only accepts http for localhost

■

sign-in does not work because browsers drop the UMP cookies when they are not marked secure;

■

The Customer portal sends repeated HTTPS redirect requests (see Step 2-Configure the UMP-365 VM)

Health probe

HTTP, host ump.example.com, path /tenantui/api/tenant/version, healthy on 200 to 399

This endpoint does not require sign-in.

WebSockets

No setting required

The Application Gateway allows access to this connection type.